In short: Cyber Essentials MFA requirements say authentication to every cloud service must use multi-factor authentication, and MFA should also protect admin and internet-facing accounts. Under the Danzell question set, a cloud service without MFA where the provider offers it, whether free, included or paid, is an automatic fail of the whole assessment.
What the requirements say about MFA
MFA sits under the User Access Control control in the NCSC's *Requirements for IT Infrastructure* v3.3. In summary:
- Use MFA wherever it is available.
- Authentication to cloud services must always use MFA.
- Always use MFA for administrative accounts and for accounts reachable from the internet, as extra protection for passwords that the other controls do not cover.
- The password element of MFA must be at least 8 characters, with no maximum length.
MFA also does double duty for passwords. It is one of the accepted ways to protect against brute-force guessing and one of the accepted ways to manage password quality, which is why an MFA-protected account can use a shorter password than one without. Our password requirements page sets out the alternatives.
The Danzell automatic fail
IASME announced in November 2025 that missing MFA on cloud services would become an automatic fail, and the rule took effect with the Danzell question set for assessments opened from 27 April 2026.
The key word is available. If a cloud service in scope offers MFA, whether it is free, included in your subscription or a paid add-on, and you have not enforced it, the assessment fails outright. It no longer matters how strong the rest of your answers are. "It costs extra on our plan" is not a defence, and neither is "only the admins have it": the requirement covers every user of the service.
It is now one of the easiest ways to fail. See why organisations fail Cyber Essentials for the others.
Which factors count
The NCSC describes four types of additional factor:
| Factor type | Typical examples |
|---|---|
| A managed or enterprise device | A company laptop or phone recognised by your identity provider |
| An app on a trusted device | An authenticator app showing a code or a push prompt to approve |
| A physically separate token | A hardware security key, smart card or code-generating token |
| A known or trusted account | A one-time code sent to an email or messaging account you control |
SMS codes are accepted. The NCSC notes they are not the most secure option, but any MFA is far better than none; where a stronger option works for your users, use that instead.
Passwordless methods are recognised too. Version 3.3 updated the definition to include FIDO2. Passkeys, including FIDO2 authenticators, count as MFA because they verify the user as part of the sign-in. Other passwordless examples the NCSC lists include biometrics, security keys or tokens, push notifications and one-time codes. Products such as Cisco Duo Passwordless are built around these methods.
How Cyber Essentials Plus tests MFA
At Cyber Essentials Plus, test case 4 of the NCSC's *Cyber Essentials Plus Test Specification* (v3.2) checks MFA configuration on every cloud service declared in scope:
- Users of the sampled devices sign in to your cloud services with their organisation-issued accounts, watched by the assessor.
- They do this from an untrusted device or a private (incognito) browser session, or the assessor shares a private browser session from their own device.
- Both standard user access and administrator access are tested, which is why the sample needs at least one standard and one admin user for each cloud service.
- Where several services share one sign-in service, such as single sign-on through Microsoft Entra ID, it is tested once for that authentication service.
If the user is prompted for MFA before access is granted, that test passes. If not, it fails, and under the test specification any single failed sub-test fails the whole assessment unless the Delivery Partner agrees the problem is minor. The Cyber Essentials Plus requirements page covers all five test cases.
Where MFA gaps usually hide
Organisations that have MFA on Microsoft 365 or Google Workspace often still have gaps elsewhere. Check:
- admin portals outside your main tenant: domain registrar, DNS host, website hosting and your firewall vendor's cloud console
- finance, payroll, HR, CRM and file-sharing services with their own separate logins
- shared or generic accounts that were left out of the MFA roll-out
- accounts used by your IT provider or contractors, which are in your scope
- older sign-in methods, such as legacy mail protocols, that can bypass modern authentication
- services someone signed up to with a work email address, which count as cloud services
Rolling out MFA without the pain, and how we help
A practical roll-out usually follows these steps:
- List every cloud service and note whether it offers MFA, and on which plan.
- Turn on MFA in each service, starting with admin accounts, using your identity provider's policies where you can (for example conditional access or security defaults in Microsoft 365, or 2-Step Verification in Google Workspace).
- Connect as many services as possible to single sign-on, so one strong MFA policy covers them all.
- Choose factors people can actually use: authenticator apps or passkeys for most staff, hardware keys for admins or people without a work phone.
- Block or retire sign-in methods that skip MFA.
- Test from a private browser session, the way a Cyber Essentials Plus assessor will.
Where an application has no built-in MFA, or you want one consistent experience across cloud apps, VPN and remote desktop, Cisco Duo MFA can add it. We plan and run MFA roll-outs, including the awkward accounts, then rehearse the Plus-style test with you. To close your MFA gaps before assessment, contact us.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is MFA mandatory for Cyber Essentials?
Yes, for cloud services. The NCSC requirements say authentication to cloud services must always use MFA, and under the Danzell question set a cloud service without MFA, where the provider offers it, is an automatic fail. MFA is also expected for admin and internet-facing accounts.
Is SMS acceptable for Cyber Essentials MFA?
Yes. SMS codes are accepted, although the NCSC says they are not the most secure type of MFA and recommends using an alternative, such as an authenticator app or security key, where one will work for your users.
Do passkeys count as MFA for Cyber Essentials?
Yes. Requirements v3.3 treats FIDO2 authenticators as passkeys and regards them as MFA, because the user is verified as part of the sign-in. Passkeys, security keys and other passwordless methods are recognised in the requirements.
Does MFA need to be on for all users or only admins?
All users of every cloud service. Admin accounts must have it, but so must standard user accounts. Cyber Essentials Plus tests both, with at least one standard and one admin user per cloud service.
What if a cloud service does not offer MFA at all?
The Danzell automatic fail applies where MFA is available, including on a paid tier. If a service genuinely offers no MFA, check whether it can sit behind single sign-on with MFA, consider replacing it, and discuss your answer with your Certification Body before you submit.